feat(T01): auth + user management + RBAC + base frontend + i18n

- Backend: FastAPI, JWT auth (HS256), bcrypt, RBAC middleware
- User CRUD (admin-only), soft-delete, pagination
- Pydantic BaseSettings config, async SQLAlchemy 2.0
- 50 backend tests, 88% coverage
- Frontend: Next.js 14 App Router, Tailwind, design tokens
- Login page, auth context, API client with auto-refresh
- i18n: next-intl, DE/EN (31 keys each)
- 6 base UI components (Button, Input, Card, Table, Modal, Toast)
- 12 frontend tests, npm build success

.a0/current_status.md

@@ -1,7 +1,27 @@
 # Current Status
 
-**Phase:** Architektur (abgeschlossen)
-**Nächste Phase:** Implementation (Phase 3)
-**Status:** Bereit, wartet auf User-Freigabe
-**Nächster Task:** T01 - Core+Auth
-**Blocker:** Keine
+**Task**: T01 – Auth + User Management + RBAC + Base Frontend Layout + i18n Setup
+**Status**: COMPLETED
+**Date**: 2026-07-14
+
+## Summary
+Backend (FastAPI) und Frontend (Next.js 14) vollständig implementiert.
+
+## Backend (COMPLETED)
+- 10 Python-Dateien erstellt (config, database, models, schemas, utils, services, dependencies, routers, main)
+- 4 Test-Dateien mit 50 Tests – alle bestanden
+- Coverage: 88% total, auth_service 95%, routers 79-100%
+- PostgreSQL 18 als Test-DB (kein SQLite)
+- bcrypt Password-Hashing, JWT HS256, RBAC require_role
+
+## Frontend (COMPLETED)
+- 6 UI-Komponenten (Button, Input, Card, Table, Modal, Toast)
+- Login-Page mit Form-Validation und Toast-Error-Handling
+- i18n mit DE/EN (31 Keys je Sprache)
+- 12 Vitest-Tests – alle bestanden
+- Next.js Production Build erfolgreich
+
+## Test Evidence
+- Backend: 50/50 pytest passed, 88% coverage
+- Frontend: 12/12 vitest passed, Next.js build success
+- test_report.md erstellt mit vollständigen Ergebnissen

.a0/next_steps.md

@@ -1,6 +1,8 @@
 # Next Steps
 
-1. User-Freigabe für Phase 3 (Implementation) einholen
-2. Plan-Mode auf implementation_allowed setzen
-3. T01 (Core+Auth) an implementation_engineer delegieren
-4. Danach: T02 (Vehicles+mobile.de)
+1. T02: Vehicle CRUD + List/Filter/Pagination (Backend + Frontend)
+2. Alembic Migration Setup für DB Schema
+3. Docker-Compose für dev/prod erstellen
+4. Redis Integration für Token-Refresh-Storage
+5. Frontend: Dashboard-Page nach Login
+6. Frontend: User Management UI (Admin)

.a0/worklog.md

@@ -12,3 +12,36 @@
 - Git: 2 Commits auf main (afe6d0a, be5a339), auf Forgejo gepusht
 - .gitignore erstellt
 - Bereit für Phase 3 (Implementation), wartet auf User-Freigabe
+
+## T01 – Auth + User Management + RBAC + Frontend + i18n (2026-07-14)
+
+### Backend
+- config.py: Pydantic BaseSettings, alle Env-Vars (DATABASE_URL, REDIS_URL, JWT_SECRET, CORS_ORIGINS, etc.)
+- database.py: Async SQLAlchemy engine, session factory, Base, init_db/drop_db
+- models/user.py: User mit UUID PK, email, password_hash, role (Enum), language, is_active, timestamps
+- schemas/user.py: LoginRequest, TokenResponse, RefreshRequest, UserCreate/Update/Response, UserListResponse
+- utils/jwt.py: create_access_token, create_refresh_token, decode_token, verify_access/refresh_token
+- services/auth_service.py: hash_password, verify_password, authenticate_user, generate_token_pair, refresh_access_token, create_user, list_users, update_user, deactivate_user
+- dependencies.py: get_pagination, get_current_user (JWT extraction), require_role (RBAC)
+- routers/auth.py: POST /login, POST /refresh, GET /me
+- routers/users.py: GET / (list paginated), POST / (create), PUT /:id (update), DELETE /:id (soft-delete) – alle admin-only
+- main.py: FastAPI app, CORS middleware, /api/v1 prefix, /health endpoint
+- tests/: conftest.py (async fixtures, PostgreSQL), test_auth.py (12 tests), test_users.py (14 tests), test_health.py (3 tests), test_auth_service.py (21 tests)
+- requirements.txt, .env.example, pytest.ini, .coveragerc
+
+### Frontend
+- package.json, tsconfig.json, next.config.js, tailwind.config.ts, vitest.config.ts
+- app/layout.tsx, app/page.tsx, app/globals.css (design tokens als CSS vars)
+- app/(auth)/layout.tsx (I18nProvider + ToastProvider wrapper)
+- app/(auth)/login/page.tsx (Login-Form mit Validation, API call, Toast on error)
+- lib/api.ts (fetch wrapper mit auto-refresh, login, getCurrentUser, listUsers, createUser, deleteUser)
+- lib/auth.ts (useAuth hook, useRequireAuth)
+- lib/i18n.tsx (I18nProvider, useI18n, DE/EN translation)
+- components/ui/: Button, Input, Card, Table, Modal, Toast (alle 6 Komponenten)
+- messages/de.json (31 keys), messages/en.json (31 keys)
+- tests/setup.ts, tests/auth.test.tsx (5 tests), tests/i18n.test.tsx (7 tests)
+
+### Test Results
+- Backend: 50/50 passed, 88% total coverage
+- Frontend: 12/12 passed, Next.js build success
+- test_report.md erstellt